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DETAILED ACTION 

1 . Claims 1-45 are pending in this application. 

2. Claims 1 and 17 are presently amended. 

3. Claims 29-45 have been newly presented in the amendment filed 26 October 
2007. 

4. The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office Action. 

Claim Rejections - 35 USC §112 

5. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using It, In such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

6. Claims 30-45 rejected under 35 U;S.C. 112, first paragraph, as failing to comply 
with the written description requirement. The claim(s) contains subject matter which 
was not described in the specification in such a way as to reasonably convey to one 
skilled in the relevant art that the inventor(s), at the time the application was filed, had 
possession of the claimed invention. The specification does not support "a computer 
readable medium encoded with program code." 



Claim Rejections - 35 USC § 101 

7. 35 U.S.C. 101 reads as follows: 
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Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereoif, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

8. Claims 30-45 are rejected under 35 U.S.C 101 because claims are directed to 
non-statutory subject matter. 

Regarding claims 30-45, the Applicant's specification fails to define "computer- 
readable medium" and merely defines it is "encode with program code" in the claims. 
Given the lack of a definition, Examiner is interpreting computer-readable medium 
based on Microsoft® Computer Dictionary, Fifth Edition. Computer-readable is defined 
as, "Of, pertaining to, or characteristic of information that can be interpreted and acted 
on by a computer. Two types of information are referred to as computer-readable: bar 
codes, magnetic tape, magnetic-ink characters, and other formats that can be scanned 
in some way and read as data by a computer; and machine code, the form in which 
instructions and data reach the computer's microprocessor." Media is defined as, "The 
physical material, such as paper, disk, and tape, used for storing computer-based 
information. Media is plural; medium is singular." Given these definitions, computer- 
readable medium may be interpreted as including non-statutory embodiments such as 
machine code stored on paper. 

Claim Rejections - 35 USC § 103 

9. Claims 1-2, 4, 10-15, 17-18, 20, 25-31. 33-39 and 41-45 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Powers et al. (Patent No.: US 6,832,086 B1), 
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hereinafter "Powers" in view of league (Pub. No.: US 2003/0229717 A1) and further in 
view of MeLampy et al. (US 7,002,973 B2). hereinafter "MeLampy". 

10. As to claim 1, Powers discloses a method of identifying service abuse, 
comprising: receiving an event requesting a service (column 3, lines 5-26, "...receives 
event notifications.."); creating an event identification associated with the event (column 

4, lines 40-65, "...creation of an event object"); selecting a table entry from a plurality of 
table entries in a screening table as a selected table entry (column 5, lines 1-25); 
incrementing a first count value associated with a first table entry of the plurality of table 
entries in the screening table in response to the event identification matching an event 
identification associated with the first table entry (column 5, lines 1-25, "The event 
counter module 54 increments the counter...."); and determining a metric value for the 
event from the screening table, the metric value indicating that the event is an abusive 
request (column 5, lines 1-25, "...determine whether the filtered event exceeds the 
threshold. If the event count exceeds the filtered event exceeds the threshold, an alarm 
is emitted to the manager 42."). Furthermore, Powers teaches the event identification 
failing to match an event identification associated with the selected table entry (column 

5, lines 1-25); 

Powers doesn't explicitly disclose decrementing a second count value associated 
with the selected table entry of the plurality of table entries in response to the event 
identification failing to match an event identification associated with the selected table 
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entry; replacing the selected table entry with the event identification associated with the 
received event in response to the second count value equaling a predetermined value; 

However, league discloses decrementing a count value of a selected table entry 
of the plurality of table entries in response to the event identification failing to match an 
event identification associated with the selected table entry ([0063], "decrements the 
counter.."). 

Therefore, it would have been obvious to one of the ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers as taught by league 
in order to reduce spamming by limiting the number of messages. 

Neither Powers nor Teague explicitly discloses replacing the selected table entry 
with the event identification associated with the event in response to the count of value 
of the selected entry equaling a predetermined value. However, MeLampy discloses 
replacing the selected table entry with the event identification associated with the event 
in response to the count of value of the selected entry equaling a predetermined value 
("...the entries that are no longer required are removed/replaced by the newer entry" - 
e.g. see col. 45, lines 20-25). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers and Teague as taught 
by MeLampy in order to allocate the resources effectively by minimizing the resourced 
used. 
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11. As to claims 1 5 and 30, these are rejected using the same rationale as for the 
rejection of claim 1 . 

12. As to claim 17, Powers discloses wherein each event packet includes an event 
identification associated with an event (column 4, lines 40-65, "...creation of an event 
object"). 

1 3. As to claims 2,18 and 31 , Power discloses wherein the event identification 
corresponds with the identity of a user (column 4, lines 40-65). 

14. As to claims 4 and 20, Power discloses wherein the event identification includes 
a user identification (column 4, lines 40-65). 

1 5. As to claims 1 0 and 34, Powers disclose further including disregarding the event 
in response to the metric value crossing a threshold value (column 5, lines 1-25). 

16. As to claims 1 1 and 35, Powers discloses further including terminating a 
connection used to receive the event in response to the metric value crossing a 
threshold value (column 5, lines 1-25). 



Application/Control Number: Page 7 

10/803,473 

Art Unit: 2135 

17. As to claim 12, Powers discloses further including returning an error message in 
response to the event in response to the metric value crossing a threshold value 
(column 5, lines 1-25). 

18. As to claim 25, Power discloses wherein the cluster host is further adapted to 
determine a metric value for an entry of the master screening table, the metric indicating 
that the entry of the master screening table corresponds to an abusive request (column 
5, lines 1-25, "...determine whether the filtered event exceeds the threshold. If the event 
count exceeds the filtered event exceeds the threshold, an alarm is emitted to the 
manager 42."). 

19. As to claim 26, Powers discloses wherein the cluster host is further adapted to 
set a block value associated with the entry in response to the metric value (column 5. 
lines 1-25) 

20. As to claims 13, 27 and 36, Powers discloses further including: determining an 
average metric value from the metric value and a set of previous metric values; and 
disregarding the event in response to the average metric value crossing a threshold 
value (column 5, lines 1-25) 

21. As to claims 14, 28 and 37, Powers disclose wherein determining a metric value 
comprises: determining a first sub-metric value from the screening table; determining a 
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second sub-metric value from a second screening table; determining the metric value 
from a weighted combination of the first and second sub-metric values (column 5, lines 
1-25). 

22. As to claim 29, neither Powers nor league explicitly disclose predetermined 
value is zero. However, MeLampy teaches predetermined value is zero (col. 45, lines 
20-25). Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers and league as taught 
by MeLampy in order to allocate the resources effectively by minimizing the resourced 
used. 

23. As to claim 33, it is rejected using the same rationale as for the rejection of claim 
1. 

24. As to claims 38, 39 and 41-45, Power doesn't explicitly disclose a server 
comprising: a processor; an input/output interface; and the computer readable medium. 
However, Teague discloses a server comprising: a processor; an input/output interface; 
and the computer readable medium (FIG. 1). Therefore, it would have been obvious to 
one of ordinary skill in the art at the time of the invention was made to modify the 
teaching of Power as taught by Teague in order to reduce spamming by limiting the 
number of messages in a client server environment. 
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25. Claims 8, 9 , 32 and 40, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Powers in view of league in view of MeLampy and further in view of 
Narad et al. (Pub. No.: US 2003/0061332 A1), hereinafter "Narad". 

26. As to claims 8 and 32, Neither Powers and league nor IVIeLampy explicitly 
disclose further including: selecting a second table entry as a new selected table entry 
in response to receiving the event. However, Narad discloses disclose further including: 
selecting a second table entry as a new selected table entry in response to receiving the 
event ([041 1], "...pointer can be used to speculatively fetch the next record.."). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, league and 
MeLampy as taught by Narad in order to minimize the memory latency. 

27. As to claim 9, it is rejected using the same rationale as for the rejection of claim 
8. 

28. As to claim 40, it is rejected using the same rationale as for the rejection of claim 
38. 

29. Claims 3, 5-7, 19 and 21-24 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Powers in view of league in view of MeLampy and further in view of 
Brothers (Pub. No. : US 2002/0083 1 78 Al ). 
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30. As to claims 3 and 19, Neither Powers and league nor MeLampy explicitly 
discloses wherein the event identification includes an IP address. However, Brothers 
discloses wherein the event identification includes an IP address (FIG. 9C). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Powers, league and MeLampy as 
taught by Brothers in order to support TCP/IP protocol which is commonly used to 
transmit data over networks. 

31 . As to claims 5 and 21 , Neither Powers and Teague nor MeLampy explicitly 
discloses wherein the event identification corresponds with a content value included in 
the event. However, Brother discloses wherein the event identification corresponds with 
a content value included in the event ([0020] - [0021], "secure content"). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, Teague and 
MeLampy as taught by Brothers in order to support various functionality as well as 
maintaining the security. 

32. As to claims 6 and 22, Neither Powers and Teague nor MeLampy explicitly 
discloses wherein the content value includes at least a portion of a message. However, 
Brother discloses wherein the content value includes at least a portion of a message 
([0020] - [0021], "secure content"). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, league and 
MeLampy as taught by Brothers in order to support various functionality as well as 
maintaining the security. 

33. As to claims 7 and 23, Neither Powers and league nor MeLampy explicitly 
discloses wherein the content value includes at least a portion of a URL. However, 
Brothers discloses wherein the content value includes at least a portion of a URL 
([0020] -[0021]). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Powers, Teague and MeLampy as 
taught by Brothers in order to support TCP/IP protocol which is commonly used to 
transmit data over networks. 

34. As to claim 24, Neither Powers and Teague nor MeLampy explicitly discloses 
wherein the content value is a hash of the content value included in the event. However, 
Brothers disclose wherein the content value is a hash of the content value included in 
the event ([0020] -[0021]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, Teague and 
MeLampy as taught by Brothers in order to support various functionality as well as 
maintaining the security. 
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35. . Claim 16 rejected under 35 U.S.C. 103(a) as being unpatentable over Powers in 
view of league in view of MeLampy and further in view of Fisherman et al. (Patent 
Number 5,586,301), hereinafter "Fisherman". 

36. As to claim 16, Neither Powers and league nor MeLampy explicitly disclose 
wherein the local screening table is a copy of the master screening table. However, 
Fisherman discloses wherein the local screening table is a copy of the master screening 
table (column 7, lines 20-40, "...the corresponding changes are made in the main file 
allocation table (MAINFAT) and in the cluster affiliation table"). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Powers, league and 
MeLampy as taught by Fisherman in order to minimize the transaction time. 

Response to Arguments 

37. Applicant's arguments filed 26 October 2007 have been fully considered but they 
are not persuasive. 



38. Applicant argues that: "league does not disclose or suggest the use of event 
identification, nor does league disclose or suggest comparing event identifications to 
determine whether to decrement a counter" 
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In response to applicant's arguments against the reference individually (i.e. 
league reference), one cannot show nonobviousness by attacking references 
individually where the rejections are based on combinations of references. See In re 
Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 
231 USPQ 375 (Fed. Cir. 1986). Power teaches the event identification failing to match 
an event identification associated with the selected table entry and Power teaches 
associating count value associated with the selected table entry (i.e. column 5, lines 1- 
25). Power is silent on decrementing a counter value. However, league reference can 
be used to modify the Power reference to decrement a count value (i.e. [0063]). 

39. Applicant argues that: "MeLampy does not disclose or suggest using a counter to 
determine whether or not to replace a table entry, nor does it disclose or suggest 
replacing a selected entry when the counter is equal to a predetermined value. 

In response to applicant's arguments against the reference individually (i.e. 
league reference), one cannot show nonobviousness by attacking references 
individually where the rejections are based on combinations of references. See In re 
Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 
231 USPQ 375 (Fed. Cir. 1986). Power discloses determining a metric value for the 
event from the screening table, the metric value indicating that the event is an abusive 
request (column 5, lines 1-25, "...determine whether the filtered event exceeds the 
threshold. If the event count exceeds the filtered event exceeds the threshold, an alarm 
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is emitted to the manager 42."). MeLampy discloses replacing a table entry when the 
entry equaling zero ("...the entries that are no longer required are removed/replaced by 
the newer entry" -e.g. see col. 45. lines 20-25). 

40, Examiner's note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. 
Although the specified citations are representative of the teachings in the art and are 
applied to the specific limitations within the individual claim, other passages and figures 
may be applied as well. It is respectfully requested from the applicant, in preparing the 
responses, to fully consider the references in entirety as potentially teaching all or part 
of the claimed invention as well as the context of the passage as taught by the prior art 
or disclosed by the examiner. 



Conclusion 

41 . THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
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extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

42. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Suman Debnath whose telephone number is 571 270 
1256. The examiner can normally be reached on 8 am to 5 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on 571 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300, 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status infomnation for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 





THANHNGATRUONG 
PRIMARY EXAMINER 



